• bwalex/tc\-play: Free and simple TrueCrypt/VeraCrypt Implementation based on dm\-crypt

TrueCrypt, VeraCrypt(3.0+) が利用できるBSDライセンスc製の実装

2021-01-09時点でのDebian のパッケージはsidでもVerCryptに対応していないバージョン(1.1-6)

• Debian \-\- パッケージ検索結果 \-\- tcplay
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=979617

$ git clone https://github.com/bwalex/tc-play
$ cd tc-play
$ make -f Makefile.classic SYSTEM=linux
$ ./tcplay -h
usage: tcplay -c -d device [-g] [-z] [-w] [-a pbkdf_hash] [-b cipher]
              [-f keyfile_hidden] [-k keyfile] [-x pbkdf_hash] [-y cipher]
       tcplay -i -d device [-e] [-p] [-f keyfile_hidden] [-k keyfile]
              [-s system_device] [--fde] [--use-backup]
              [--use-hdr-file=hdr_file] [--use-hidden-hdr-file=hdr_file]
       tcplay -m mapping -d device [-e] [-p] [-f keyfile_hidden] [-k keyfile]
              [-s system_device] [--fde] [--use-backup] [--allow-trim]
              [--use-hdr-file=hdr_file] [--use-hidden-hdr-file=hdr_file]
       tcplay --modify -d device [-k keyfile] [--new-keyfile=keyfile]
              [--new-pbkdf-prf=pbkdf_hash] [-s system_device] [--fde]
              [--use-backup] [--save-hdr-to-file=hdr_file] [-w]
              [--use-hdr-file=hdr_file] [--use-hidden-hdr-file=hdr_file]
       tcplay --modify -d device [-k keyfile] --restore-from-backup-hdr [-w]
       tcplay -j mapping
       tcplay -u mapping
       tcplay -h | -v

Valid commands are:
 -c, --create
	 Creates a new TC volume on the device specified by -d or --device.
 -h, --help
	 Print help message and exit.
 -i, --info
	 Gives information about the TC volume specified by -d or --device.
 -j <mapping name>, --info-mapped=<mapping name>
	 Gives information about the mapped TC volume under the given mapping.
 -m <mapping name>, --map=<mapping name>
	 Creates a dm-crypt mapping with the given name for the device
	 specified by -d or --device.
 -u <mapping name>, --unmap=<mapping name>
	 Removes a dm-crypt mapping with the given name.
 --modify
	 Changes the volume's passphrase, keyfile and optionally the hashing
	 function used for the PBKDF password derivation.
 -v, --version
	 Print version message and exit.

Valid options for --create are:
 -a <pbkdf prf algorithm>, --pbkdf-prf=<pbkdf prf algorithm>
	 Specifies which hashing function to use for the PBKDF password
	 derivation when creating a new volume.
	 To see valid options, specify '-a help'.
 -b <cipher>, --cipher=<cipher>
	 Specifies which cipher to use when creating a new TC volume.
	 To see valid options, specify '-b help'.
 -g, --hidden
	 Specifies that the newly created volume will contain a hidden volume.
 -x <pbkdf prf algorithm>, --pbkdf-prf=<pbkdf prf algorithm>
	 Specifies which hashing function to use for the PBKDF password
	 derivation when creating a new hidden volume.  By default, the
	 same as for the outer volume will be used.
	 To see valid options, specify '-x help'.
 -y <cipher>, --cipher=<cipher>
	 Specifies which cipher to use when creating a new hidden volume.
	 By default, the same as for the outer volume will be used.
	 To see valid options, specify '-y help'.
 -z, --insecure-erase
	 Skips the erase of the disk. Possible security hazard.
 -w, --weak-keys
	 Uses a weak source of entropy (urandom) for key material.
	 WARNING: This is a REALLY REALLY bad idea for anything but
	 testing.

Valid options for --modify are:
 --new-keyfile=<key file>
	 Specifies a key file to use for the password derivation, when
	 re-encrypting the header, can appear multiple times.
 --new-pbkdf-prf=<pbkdf prf algorithm>
	 Specifies which hashing function to use for the PBKDF password
	 derivation when re-encrypting the header.
	 To see valid options, specify '-a help'.
 -s <disk path>, --system-encryption=<disk path>
	 Specifies that the disk (e.g. /dev/da0) is using system encryption.
 --fde
	 Specifies that the disk (e.g. /dev/da0) is using full disk encryption.
 --use-backup
	 Uses the backup headers (at the end of the volume) instead of the
	 primary headers. Both normal and backup headers will be modified!
	 This is useful when your primary headers have been corrupted.
 --use-hdr-file=<header file>
	 Use the header in the specified file instead of the main header on the
	 disk as source for the modify operation.
 --use-hidden-hdr-file=<header file>
	 Use the header in the specified file instead of the hidden header on the
	 disk as source for the modify operation.
 --restore-from-backup-hdr
	 Implies --use-backup, no new PBKDF hashing function, no new keyfiles
	 and no new passphrase.
	 In other words, this will simply restore both headers from the backup
	 header. This option cannot be used to restore from a backup header file.
 -w, --weak-keys
	 Uses a weak source of entropy (urandom) for salt material. The
	 key material is not affected, as the master keys are kept intact.
	 WARNING: This is a bad idea for anything but testing.
 --save-hdr-backup=<header file>
	 Saves the modified header in the specified file instead of updating
	 the header files on disk.

Valid options for --info and --map are:
 -e, --protect-hidden
	 Protect a hidden volume when mounting the outer volume.
 -p, --prompt-passphrase
	 Immediately prompt for a passphrase even if a keyfile is supplied.
 -s <disk path>, --system-encryption=<disk path>
	 Specifies that the disk (e.g. /dev/da0) is using system encryption.
 -t, --allow-trim
	 Allow discards (TRIM command) on mapped volume.
 --fde
	 Specifies that the disk (e.g. /dev/da0) is using full disk encryption.
 --use-backup
	 Uses the backup headers (at the end of the volume) instead of the
	 primary headers.
	 This is useful when your primary headers have been corrupted.
 --use-hdr-file=<header file>
	 Use the header in the specified file instead of the main header on the
	 disk.
 --use-hidden-hdr-file=<header file>
	 Use the header in the specified file instead of the hidden header on the
	 disk.

Valid options common to all commands are:
 -d <device path>, --device=<device path>
	 Specifies the path to the volume to operate on (e.g. /dev/da0s1).
 -f <key file>, --keyfile-hidden=<key file>
	 Specifies a key file to use for the hidden volume password derivation.
	 This option is only valid in combination with -e, --protect-hidden
	 or -g, --hidden.
 -k <key file>, --keyfile=<key file>
	 Specifies a key file to use for the password derivation, can appear
	 multiple times.